-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the ec2_key module's handling of AWS keypair creation responses. When creating new keypairs, AWS returns private key material which the module directly includes in its JSON output. Ansible modules typically return results through standard output, which gets logged by default. The absence of 'no_log: true' parameter on sensitive fields and direct inclusion of private_key in module output matches the described exposure mechanism. The execute_module and main functions are core entry points for module execution where this sensitive data handling would occur.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansible-core | pip | >= 2.8.0, <= 2.15.2 |